---
schema_version: "1"
id: bab4504cb01d1b139fee60499aefdcdb98b15d62a0d54862814f2c87f7b4f71f
title: Enable External Credential Principals
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_enable_ext_cred_principal.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_enable_ext_cred_principal.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 365e238c46d3837bdf418d48577d08fbee9ebedc254fa23e6f07c389d1c0b5c5
description: Principals link an external credential to permission sets or user profiles so that users can make callouts using the named credential. At run time, Salesforce ensures that the user has the permission set before accessing the remote system.
products:
  - Security
release: "264"
---
# Enable External Credential Principals

Principals link an external credential to permission sets or user profiles so that users can make callouts using the named credential. At run time, Salesforce ensures that the user has the permission set before accessing the remote system.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Permission sets available in: <strong>Contact Manager</strong>, <strong>Group</strong>, <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, <strong>Developer</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d86969e89">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d86969e89 ">To edit permission sets and user profiles:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d86969e89 ">Manage Profiles and Permission Sets</td>

          </tr>
        </tbody>
      </table>

After you create external credentials and principals, take these steps to give permission sets and profiles access to the principals of the external credential.

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_tip.png)

Tip To apply credential permissions to the largest number of users, link a principal to a permission set and add the permission set to a permission set group.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Permission Sets** or **Profiles**.
2. Click the name of the permission set or profile that you want to modify.
3. Take one of these steps.
    - For a permission set, click **External Credential Principal Access** in the Apps section.
        
        Permission sets with external credential principal access enabled can be packaged.
    - For a profile, click **Enabled External Credential Principal Access**.
        
        Profiles associated with guest users are also supported.
4. Click **Edit**.
    
    The Edit page displays two columns: one for available external credential principals, and one for external credential principals that are currently enabled.
    
    External credential principals take the form external credential name - external credential principal parameter name.
    
    For example, an external credential principal can have a name like JWT OAuth Credential - Marketing User.
5. Select one or more external credential principals from the list of available principals. To move them into the Enabled column, click the **Add** arrow.
6. Save your changes.

Most standard permission sets and profiles have access to the User External Credentials object by default. If you use these permission sets and profiles, enabling external credential principals is the last step to create a named credential. For the guest user profile, and for some custom permission sets and profiles, you must assign User External Credentials object permissions manually. For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").